Vendor Data Pribadi: Tanggung Jawab Tetap di Pengendali

A bank appoints a vendor to open a booth in a shopping center. The task is clear: offer products, record data of interested potential customers, and then input it into the bank's system. A few months later, that data appears elsewhere. The first question that usually arises in the meeting room: this is the vendor's responsibility, right?

Law Number 27 of 2022 on Personal Data Protection answers this through the division of roles, not by who signs the contract.

Two roles, and what matters is the reality

Article 1 number 4 defines the Personal Data Controller as the party that determines the purpose and controls the processing. Article 1 number 5 defines the Personal Data Processor as the party that processes data on behalf of the controller. The bank in the previous example is the controller, as it is the one that determines the purpose for which the data is collected. The vendor is the processor.

This role is attached to who determines the purpose, not to the designation in the cooperation document. Naming a party as a partner or agent does not change its position in the eyes of the law.

Rules that often surprise

Article 51 paragraph (1) requires the processor to process data based on the controller's instructions. What is rarely read to the end is paragraph (3): processing carried out according to those instructions is included in the controller's responsibility. Appointing a vendor does not transfer responsibility outside. As long as the vendor operates within the instructions, the one who bears the responsibility remains the party giving the instructions.

Responsibility only shifts under one condition, and Article 51 paragraph (6) states it clearly: when the processor processes data outside the instructions and purposes set by the controller, that processing becomes the processor's responsibility. In the previous example, recording potential customer data is still within the instructions. Using the same list to offer products from another party is already outside.

There is one obligation that is easily overlooked. Article 51 paragraph (4) allows the processor to involve another processor, but paragraph (5) requires written consent from the controller before this is done. A vendor that transfers data input work to a third party without written consent violates this paragraph, not just the contract.

Obligations that also attach to the vendor

Article 52 states that the obligations of the controller in Articles 29, 31, 35, 36, 37, 38, and 39 also apply to the processor. The contents in order are: ensuring data accuracy (29), recording all processing activities (31), implementing technical security measures (35), maintaining confidentiality (36), supervising every party involved (37), protecting data from unlawful processing (38), and preventing unauthorized access (39).

Note Article 31. Records of processing activities are not voluntary documents, and this obligation stands on both sides.

Numbers and deadlines to note

3 x 24 hours. Article 46 paragraph (1): in the event of a personal data protection failure, the controller must notify the data subject and the agency in writing no later than 3 x 24 hours. This obligation lies with the controller and is not passed on to the processor by Article 52. For this reason, the vendor agreement needs to include a shorter notification deadline, so the controller still has time to meet its own deadline.
Two percent. Article 57 paragraph (3): the highest administrative fine is 2 percent of annual revenue or annual receipts for the violation variable. Violations of Article 51 paragraphs (1) and (5) as well as Article 52 are among those subject to administrative sanctions.
Five years and Rp 5 billion. Criminal threats in Article 67 paragraphs (1) and (3) for obtaining or using personal data that does not belong to them unlawfully. For corporations, Article 70 paragraph (3) increases the criminal fine up to 10 times the maximum threat.
January 16, 2027. Government Regulation Number 33 of 2026, the implementing regulation of the PDP Law, was established on July 16, 2026, and will take effect six months after its promulgation. The adjustment period is currently underway.

The transition period for the law itself has long closed. Article 74 gives two years from the promulgation of the PDP Law on October 17, 2022.

What can be done this week

Write the purpose and limits of the instructions explicitly in the agreement. Prohibit the use of data for the vendor's own interests. Require written consent before the vendor engages other parties. Set a notification deadline for incidents shorter than 3 x 24 hours. Arrange for the return or destruction of data when the cooperation ends, and keep processing records on both sides from day one.

If you prefer to see the explanation of this vendor case directly, there is a clip at taalenta.id/video/pso-vendor-yang-anda-tunjuk-boleh-mengumpulkan-data-customer.

Appointing a Vendor Does Not Transfer Responsibility for Customer Data

Two roles, and what matters is the reality

Rules that often surprise

Obligations that also attach to the vendor

Numbers and deadlines to note

What can be done this week

Sources